What our analysis found

Open in Microsoft Edge, used by 10,000 people, is rated caution by Extension Auditor. Our code review reported 4 findings (1 critical, 2 high, 1 medium), led by privilege escalation. It comes from a trusted publisher and was last updated in September 2022.

Key findings

• critical· privilege escalation —The native messaging payload includes a complete script string that calls require('child_process').spawn with caller-controlled arguments, and declares 'permissions: [child_process]'. This pattern is characteristic of a native messaging host that acts as a code evaluator — the script field is passed to be eval'd, not ignored. Any future extension update (or a malicious native host update from) could change the script payload to execute arbitrary commands with full OS privileges, since native messaging hosts run outside the browser sandbox.
• high· other —The bundled manifest declares manifest_version 2, while the published CWS listing reports manifest_version 3. This mismatch means the extension actually installed on user devices uses MV2 (which permits persistent background pages and broader APIs), while the CWS listing presents the safer MV3 profile to reviewers — a common technique to pass CWS review with a more permissive version.
• high· other —The options page, shipped inside an extension branded as 'Open in Microsoft Edge', explicitly instructs users to enter the path to Tor Browser and pre-fills a Tor Browser path as the example. This is direct evidence that the extension is a template reused from an 'Open with Tor' extension without proper rebrand — the branding deception is intentional, not accidental.
• medium· other —The 'How to use' link in the popup for this 'Open in Microsoft Edge' extension directs users to — the Tor browser companion site from the same publisher network. This confirms the extension is a renamed copy of a Tor-opener extension distributed under a false Microsoft Edge identity to attract installs from users who trust the Edge brand.

The extension presents as 'Open in Microsoft Edge' but the source code is a poorly-rebranded copy of an 'Open with Tor' extension from — the options page instructs users to enter a 'path for Tor browser', is titled 'Open with VLC', names its menu item 'Open with PowerPoint', and links to. More critically, sends a hardcoded script string (including require('child_process').spawn) to a native host at net.freefinancetools.openfrombrowser, a design pattern that implies the native host is a evaluator executing arbitrary code — far beyond what is needed to simply open a URL. The permhash cluster has 44% malicious peers and the publisher has 33% malicious rate across their portfolio, corroborating the ML and third-party signals.